Privacy Policy

Last Updated: April 30, 2026

PRIVACY SNAPSHOT

Luabase, Inc. ("Luabase," "we," "us," or "our") provides a SaaS-based business intelligence platform. This Privacy Policy describes how we handle personal information that we collect about representatives of our current and prospective business customers, including when they use our services or visit our websites (collectively, "the Services").

In our capacity as a service provider, we may process personal information pertaining to our customers' employees, clients, or other end users. This information is governed by our customers' own privacy policies, as well as our agreements with our customers.

Luabase's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

Personal Information We Collect

Information you provide to us may include:

• Account information and contact details, such as your company's name, your first and last name, username and password, email address, mailing address, and phone number.

• Communications that we exchange with you, including when you contact us with questions, feedback, or otherwise.

• Marketing data, such as your preferences for receiving our marketing communications, and details about your engagement with them.

• Other data not specifically listed here, which we will use as described in this Privacy Policy or as otherwise disclosed at the time of collection.

Third party sources. We may combine personal information we receive from you with personal information we obtain from other sources, such as:

• Social media information. We may maintain pages on social media platforms, such as Twitter, LinkedIn, and other third-party platforms. When you visit or interact with our pages on those platforms, the platform provider's privacy policy will apply to your interactions and their collection, use and processing of your personal information. You or the platforms may provide us with information through the platform, and we will treat such information in accordance with this Privacy Policy.

• Third-party login information. When you link, connect, or login to the Services with a third party service (e.g., Google), you direct the service to send us information such as your registration and profile information as controlled by that service or as authorized by you via your privacy settings at that service.

• Other Sources. We may obtain your personal information from other third parties, such as marketing partners, publicly-available sources and data providers.

Automatic data collection. We, our service providers, and our advertising partners may automatically log information about you, your computer or mobile device, and your interaction over time with our website and the Services, our communications and other online services, such as:

• Device data,such as your computer's or mobile device's operating system type and version, manufacturer and model, browser type, screen resolution, RAM and disk size, CPU usage, device type (e.g., phone, tablet), IP address, unique identifiers (including identifiers used for advertising purposes), language settings, mobile device carrier, radio/network information (e.g., WiFi, LTE, 3G), and general location information such as city, state or geographic area.

• Online activity data, such as pages or screens you viewed, how long you spent on a page or screen, the website you visited before browsing to the website, navigation paths between pages or screens, information about your activity on a page or screen, access times, and duration of access, and whether you have opened our marketing emails or clicked links within them.

We collect this information using cookies and other similar technologies. For more information, please visit our Cookie Policy.

How We Use Personal Information

We use your personal information for the following purposes:

Providing our Services. We use personal information to operate, maintain, and provide you with our Services, including to process your transactions. In particular, we use personal information to perform our contractual obligations under our Terms of Use.

Communicating with you about our Services. It is in our legitimate business interests to use personal information to respond to your requests, provide customer support, and communicate with you about our Services, including by sending announcements, updates, security alerts and support and administrative messages.

Improving, monitoring, personalizing, and protecting our Services. It is in our legitimate business interests to improve and keep our Services safe for our users, which includes:

• understanding your needs and interests, and personalize your experience with the Services and our communications;

• troubleshooting, testing and research and to keep the Services secure; and

• investigating and protecting against fraudulent, harmful, unauthorized or illegal activity.

Research and development. We may process personal information to support service enhancements and business improvements. This may include the use of analytics tools to assess engagement with application features. We do not access or utilize customer-connected data—such as information sourced from third-party platforms like accounting or payment systems—for these purposes.

Marketing and advertising. We, our service providers, and our third-party advertising partners may collect and use personal information for the following marketing and advertising purposes:

• Direct marketing. We may send you direct marketing communications as permitted by law, including by email. You may opt-out of our marketing communications as described in the Opt out of marketing communications section below.

• Interest-based advertising. We may engage third-party advertising companies, such as Google, to display our ads on their online services. We may also share information about our users with these companies to facilitate advertising for our services to them or similar users on other online platforms. For more information, or to understand your choices, please visit our Cookie Policy.

Except where consent is required, we undertake such marketing and advertising on the basis of our legitimate business interests. Where we seek your consent, you may withdraw your consent at any time.

Compliance and protection. We may use personal information to comply with legal obligations, and to defend us against legal claims or disputes, including to:

• protect our, your or others' rights, privacy, safety or property (including by making and defending legal claims);

• audit our internal processes for compliance with legal and contractual requirements and internal policies;

• enforce the terms and conditions that govern the services;

• prevent, identify, investigate and deter fraudulent, harmful, unauthorized, unethical or illegal activity, including cyberattacks and identity theft; and

• comply with applicable laws, lawful requests and legal process, such as to respond to subpoenas or requests from government authorities.

How We Share Personal Information

We may share your personal information with:

Affiliates. Our corporate parent, subsidiaries, and affiliates, for purposes consistent with this Privacy Policy.

Service providers. Companies and individuals that provide services on our behalf or help us operate our Services or our business (such as banking partners, hosting, information technology, customer support, email delivery, and website analytics services).

Advertising partners. Third party advertising companies, including for the interest-based advertising purposes described above, that may collect information on our website through cookies and other automated technologies.

Professional advisors. Professional advisors, such as lawyers, auditors, bankers and insurers, where necessary in the course of the professional services that they render to us.

Authorities and others. Law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate for the compliance and protection purposes described above.

Business transferees. Acquirers and other relevant participants in business transactions (or negotiations for such transactions) involving a corporate divestiture, merger, consolidation, acquisition, reorganization, sale or other disposition of all or any portion of the business or assets of, or equity interests in, Luabase or our affiliates (including, in connection with a bankruptcy or similar proceedings).

Your Privacy Rights and Choices

Opt out of marketing communications. You may opt out of marketing-related communications by following the opt out or unsubscribe instructions contained in the marketing communications we send you.

Personal information requests. We also offer you choices that affect how we handle the personal information that we control. Depending on your location and the nature of your interactions with our services, you may request the following in relation to personal information:

• Information about how we have collected and used personal information. We have made this information available to you without having to request it by including it in this Privacy Policy.

• Access to a copy of the personal information that we have collected about you. Where applicable, we will provide the information in a portable, machine-readable, readily usable format.

• Correction of personal information that is inaccurate or out of date.

• Deletion of personal information that we no longer need to provide the Services or for other lawful purposes.

• Opt out of targeted advertising. We use cookies and other similar technologies on our website to help us advertise our Services on other websites or services you visit. We share personal information with advertising partners that display targeted advertisements to users around the web. You can limit online tracking as described in our Cookie Policy or by clicking here. We do not sell personal information.

• Additional rights, such as to object to and request that we restrict our use of personal information.

To make a request, please email us or write to us as provided in the How to Contact Us section below. We may ask for specific information from you to help us confirm your identity. Depending on where you reside, you may be entitled to empower an "authorized agent" to submit requests on your behalf. We will require authorized agents to confirm their identity and authority, in accordance with applicable laws. You are entitled to exercise the rights described above free from discrimination.

Limits on your privacy rights and choices. In some instances, your choices may be limited, such as where fulfilling your request would impair the rights of others, our ability to provide a service you have requested, or our ability to comply with our legal obligations and enforce our legal rights. If you are not satisfied with how we address your request, you may submit a complaint by contacting us as provided in the How to Contact Us section below.

Right to complain. Depending on where you reside, such as if you reside in the European Economic Area or United Kingdom, you may have the right to complain to a data protection regulator where you live or work, or where you feel a violation has occurred. Click here to find your local supervisory authority.

Data Sharing With Third-Party Tools

What Data We Share

We recognize the importance of privacy and transparency in our use of third-party tools, including but not limited to artificial intelligence models, analytics platforms, and other software services that enhance our Services. To provide, improve, protect, and personalize our Services, we may share the following types of personal information with third-party tools:

• Anonymized and Aggregated Data: This includes data that has been processed to remove personally identifiable information and aggregated with other data to help understand trends and user needs without identifying individual users.
• Operational Data: This may include non-sensitive, operational data necessary for the functionality of third-party tools, such as user interaction metrics, device type, and system performance data.
• Specific User Data: In cases where more specific user data is shared, such as for personalized user experiences or integrations with third-party services, we ensure that the data is limited to what is strictly necessary for the specific service or functionality.

MCP Server Access

When you authorize a third-party AI client (e.g., Claude) to connect to Definite via our Model Context Protocol (MCP) server at api.definite.app/v3/mcp/http, the client receives a scoped OAuth access token bound to your account. Queries and tool calls are executed against your Definite workspace and returned directly to the authorized client.

We do not retain query payloads or use your warehouse data to train any AI model. OAuth access tokens expire after 15 minutes; refresh tokens expire after 7 days. You may revoke access at any time from your account settings.

Other Sites and Services

Our Services may contain links to websites and other online services operated by third parties. In addition, our content may be integrated into web pages or other online services that are not associated with us. These links and integrations are not an endorsement of, or representation that we are affiliated with, any third party. We do not control websites or online services operated by third parties, and we are not responsible for their actions.

Data Security

We employ a number of technical, organizational and physical safeguards designed to protect the personal information we collect. However, no security measures are failsafe and we cannot guarantee the security of your personal information.

Data Retention

We may retain your personal data for as long as it is reasonably needed in order to maintain and expand our relationship and provide you with our Services; in order to comply with our legal and contractual obligations; or to protect ourselves from any potential disputes. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of such data, the potential risk of harm from unauthorized use or disclosure of such data, the purposes for which we process it, and the applicable legal requirements.

International Data Transfer

You will provide personal information directly to our website in the United States. We may also transfer personal information to our affiliates and service providers in the United States and other jurisdictions. Please note that such jurisdictions may not provide the same protections as the data protection laws in your home country.

When we engage in cross-border data transfers, we will ensure that relevant safeguards are in place to afford adequate protection for personal information and we will comply with applicable data protection laws, in particular by relying on an EU Commission or UK government adequacy decision or on contractual protections for the transfer of personal information. For more information about how we transfer personal information internationally, please contact us as set out in the How to Contact Us section below.

Children

The Services are not intended for use by children under 13 years of age. If we learn that we have collected personal information through our Services from a child under 13 without the consent of the child's parent or guardian as required by law, we will delete it.

Changes to This Privacy Policy

We reserve the right to modify this Privacy Policy at any time. If we make material changes to this Privacy Policy, we will notify you by updating the date of this Privacy Policy and posting it on the website.

How to Contact Us

Responsible entity. Luabase is the entity responsible for the processing of personal information under this Privacy Policy (as a controller, where provided under applicable law).

Contact us. If you have any questions or comments about this Policy, our privacy practices, or if you would like to exercise your rights with respect to your personal information, please contact us by email at hello@definite.app or at the following mailing address:

Privacy Snapshot

Here is a high-level snapshot of our privacy practices, but you need to read the entire Privacy Policy for complete information.